This invention relates to the use of software tokens (also known as soft-tokens) to securely sign in to remote services. As the name implies, soft-tokens are software-only alternatives to hardware based tokens and smart cards. As such, soft-tokens are meant to fill the gap where hardware tokens are impractical or inconvenient and password-only verification is not a high enough level of security.
Traditionally, access to remote services was protected almost solely by user names and passwords. As the weaknesses in a password-only system were realized by the industry, hardware based authentication devices were developed to provide an additional factor of authentication. This required users to have a physical device and know the associated PIN (Personal Identification Number) for that device. However, there was still a need for stronger authentication without adding an additional hardware device for every user, and so soft-tokens were conceived.
In the scope of this invention, a soft-token is a logical grouping of data used to verify the local user device being used by a user in addition to the user PIN which is something the user knows himself. This is considered an improvement in security over password-only systems since an attacker would need to compromise the user device in addition to knowing the user's PIN. For the scope of this invention, the use of PIN is considered to be synonymous with password.
State-of-the-art products thus providing soft-token authentication suffer, from one or more of the following deficiencies and limitations that limit the realization of their full potential and effectiveness:                First, systems that store soft-token credentials in a certificate store or key chain that is available to other applications on the device are vulnerable to having the soft-tokens stolen or misused by malware and malicious users.        Second, systems that protect against the above stated vulnerability commonly encrypt the credential data with a PIN. However, this makes the encrypted data vulnerable to brute-force-attacks on the user's PIN since the PIN can be guessed and verified without any additional information.        Third, soft-tokens that use a stored credential that changes infrequently cannot prevent that credential from being copied and used on other devices, which is in contradiction to the benefits and reason for having a soft-token in the first place.        Fourth, soft-token systems that rely on a stored private key require that the device using the soft-token perform an asymmetric operation each time the token is used. As soft-tokens could be used on a variety of small mobile devices such as smart phones and tablets, this additional computational requirement may degrade the user experience.        